Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP4:GA
python-requests
CVE-2023-32681.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2023-32681.patch of Package python-requests
Index: requests-2.24.0/requests/sessions.py =================================================================== --- requests-2.24.0.orig/requests/sessions.py +++ requests-2.24.0/requests/sessions.py @@ -306,7 +306,9 @@ class SessionRedirectMixin(object): except KeyError: username, password = None, None - if username and password: + # urllib3 handles proxy authorization for us in the standard adapter. + # Avoid appending this to TLS tunneled requests where it may be leaked. + if not scheme.startswith('https') and username and password: headers['Proxy-Authorization'] = _basic_auth_str(username, password) return new_proxies Index: requests-2.24.0/tests/test_requests.py =================================================================== --- requests-2.24.0.orig/tests/test_requests.py +++ requests-2.24.0/tests/test_requests.py @@ -551,6 +551,26 @@ class TestRequests: with pytest.raises(InvalidProxyURL): requests.get(httpbin(), proxies={'http': 'http:///example.com:8080'}) + + @pytest.mark.parametrize( + "url,has_proxy_auth", + ( + ('http://example.com', True), + ('https://example.com', False), + ), + ) + def test_proxy_authorization_not_appended_to_https_request(self, url, has_proxy_auth): + session = requests.Session() + proxies = { + 'http': 'http://test:pass@localhost:8080', + 'https': 'http://test:pass@localhost:8090', + } + req = requests.Request('GET', url) + prep = req.prepare() + session.rebuild_proxies(prep, proxies) + + assert ('Proxy-Authorization' in prep.headers) is has_proxy_auth + def test_basicauth_with_netrc(self, httpbin): auth = ('user', 'pass') wrong_auth = ('wronguser', 'wrongpass')
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor